Key Impacts to Foreign-funded Banks under the Amended AML Law

Authors: Han Kun Law Offices Ting Zheng丨Raymond Yan 丨Eryin Ying丨Lin Zhu丨Shirley Liang

On 8 November 2024, the Standing Committee of the National People's Congress, after three readings, adopted the amended Anti-Money Laundering Law (the “Amended AML Law”), which will take effect on 1 January 2025 and replace the original Anti-Money Laundering Law (the “Original AML Law”), in effect since 2007.

In general, most of the amendments adopted under the Amended AML Law have not introduced new regulatory requirements but incorporated those regulatory requirements that have already been provided and implemented for years in the administrative regulations and regulatory rules issued by the People’s Bank of China (PBOC) and other competent authorities, though the Amended AML Law has also provided several innovative provisions, such as the extra-territorial application of the Amended AML Law and new regulatory regime for the sharing of AML information (including personal information).

To facilitate your understanding of the Amended AML Law and its implications on foreign-funded banks, we have prepared this note outlining the key amendments made under the Amended AML Law that are particularly relevant to foreign-funded banks’ operations.

Article 2 of the Amended AML Law, compared with Article 2 of the Original AML Law, has expressly clarified that the money-laundering activities under the Amended AML Law are not limited to the seven (7) criminal activities specified thereunder. From a regulatory and compliance perspective, such activities to hide or conceal the source and nature of gains and other profits from other crimes, e.g., telecommunications fraud, tax evasion and fraud, shall also be within the scope of money-laundering activities and shall be subject to strict scrutiny by foreign-funded banks.

With the above said, PBOC has, long before the promulgation of the Amended AML Law, expanded the scope of money-laundering activities and required financial institutions to strengthen their account opening procedures and reporting procedures for suspicious transactions on that basis under the Notice of People's Bank of China on Strengthening Administration of Account Opening and Follow-up Control Measures for Suspicious Transaction Reporting (《中国人民银行关于加强开户管理及可疑交易报告后续控制措施的通知》).

Article 35 of the Original AML Law merely provides that the specific non-financial institutions shall perform AML obligations, but does not define the scope of such specific non-financial institutions and leave it to the anti-money laundering administrative authority (i.e., PBOC) and relevant State Council departments for further clarification. Article 64 of the Amended AML Law explicitly clarifies that, real estate development companies, accounting firms, law firms, notary offices, and dealers in precious metals and gemstones that satisfy certain criteria shall perform the AML obligations of specific non-financial institutions under the Amended AML Law.

Notably, prior to the promulgation of the Amended AML Law, PBOC has provided in the Notice of the General Office of the People’s Bank of China on Strengthening the Anti-Money Laundering Supervision over Specific Non-Financial Institutions (《中国人民银行办公厅关于加强特定非金融机构反洗钱监管工作的通知》) that real estate development companies, real estate agencies, dealers in precious metals, precious metals exchanges, accounting firms, law firms, notary agencies, and company service providers fall in the scope of specific non-financial institutions and shall perform AML obligations.

Consistent with Article 5 of the Original AML Law and Article 41 of the Money Laundering and Terrorist Financing Risk Management Guidelines for Corporate Financial Institutions (for Trial Implementation) (《法人金融机构洗钱和恐怖融资风险管理指引(试行)》,  the “Circular No. 19”), Article 7 of the Amended AML Law reiterates that the identification data and transaction information of the clients and AML investigation information must be kept in strict confidence and must not be provided to any third party unless otherwise provided by laws.

Article 37 of the Amended AML Law expressly requires a financial institution that has branches or holdings in other financial institutions at home and abroad, as well as a financial holding company, must coordinate anti-money laundering work at the head office or group level. This constitutes a mandatory legal obligation for financial groups, pursuant to which, foreign-funded banks will be permitted to share AML related information (including personal information) within the group without the need to obtain relevant individuals’ consent under Article 13 of the Personal Information Protection Law (《个人信息保护法》), provided that: (i) the banks are required to establish clear mechanisms and procedures for information sharing; (ii) the information must be shared in compliance with relevant data protection laws – the banks will still need to perform other data protection obligations, such as entering into standard contract for cross-border transfer of personal information or opting for other alternative permitted approaches for cross-border transfer of personal information, performing self-assessment, etc.; and (iii) the information shared within the group must be used solely for AML and counter-terrorism financing purposes.

On the basis of Article 41 of the Circular No. 19, paragraph 1 of Article 50 of the Amended AML Law provides that where the onshore financial institutions (including foreign-funded banks in the PRC) are requested by offshore regulators to provide client identification data or transaction information, to seize, freeze, transfer domestic funds or assets, or take other actions, which are not in accordance with the principle of reciprocity or consensus agreement with the PRC, the onshore financial institutions must refrain from acting on the requests of offshore regulators and report to the relevant financial administrative department of the State Council promptly. This echoes the extra-territorial enforcement power of PRC regulators under Article 49 of the AML Amended Law, which is further discussed in paragraph 12 below. Where PRC regulators will be entitled to directly request offshore financial institutions to cooperate to provide AML information or take relevant actions, then the onshore financial institutions should also be permitted to cooperate with the offshore regulators in the jurisdictions where the said offshore financial institutions are located in accordance with the principle of reciprocity or consensus agreement between the PRC and the relevant jurisdictions.

Notwithstanding paragraph 1 of Article 50, paragraph 2 provides that where an offshore regulator, for legitimate regulatory purposes, requests general compliance or operational information, the onshore financial institutions will be permitted to provide such information after reporting to the financial administrative department of the State Council and competent authorities. It still remains to be clarified what is the scope of the “general compliance or compliance information”, the “financial administrative department of the State Council and competent authorities” and how the reporting should be made. We expect PBOC and the National Financial Regulatory Administration will separately provide guidance in this regard.

Paragraph 3 of Article 50 further provides that the provision of important data and personal information shall comply with relevant provisions under PRC laws. Foreign-funded banks will still need to follow the required formalities and procedures for the cross-border transfer of important data and personal information under other applicable laws when providing such data constituting part of AML related information to offshore regulators.

The definition of UBO was not used in the Original AML Law. Article 19 of the Amended AML Law clarifies that the UBO shall refer to the natural person who ultimately owns or actually controls the legal person or unincorporated organization, or enjoys the ultimate benefits of the legal person or unincorporated organization. The standards for the identification of UBOs shall be formulated by the PBOC and relevant departments under the State Council (e.g., the State Administration for Market Regulation (“SAMR”)). Foreign-funded banks may refer to the following standards for the identification of UBOs:

• Circular on Strengthening Client Identification for Anti-money Laundering (Yin Fa [2017] No.235) (《关于加强反洗钱客户身份识别有关工作的通知》(银发[2017]235号));

• Circular on Issues concerning Further Improving the Identification of Beneficial Owners (《关于进一步做好受益所有人身份识别工作有关问题的通知);

• Administrative Measures on Beneficial Owner Information (《受益所有人信息管理办法》); and

• Guidance on Information Filing of Beneficial Owners (《受益所有人信息备案指南》).

Notably, both market participants (including legal persons and unincorporated organization) and AML obligors are obliged to identify UBOs, specifically:

• market participants shall identify and file the information of UBOs when making registrations with local AMRs, and shall update the information of UBOs in a timely manner. Failure to do so may result in measures being taken in accordance with administrative regulations on enterprise registration or be subject to being ordered to rectify or fines imposed by PBOC or its local branches; and

• AML obligors (including foreign-funded banks) must independently identify and verify the UBOs of their clients, and where any inconsistency or incompleteness is spotted, they shall provide feedback to PBOC in a timely manner.

Article 25 provides that AML obligors can establish an AML self-discipline organization which will coordinate with other self-discipline organizations to carry out self-discipline administration on AML matters. It is expected that PBOC will lead and supervise the establishment and operation of the self-discipline organization specifically for AML purposes. AML obligors that have become a member of such organization will need to accept the supervision and abide by the self-disciplinary rules issued by the said organization.

Article 27 of the Amended AML Law requires financial institutions to: (1) establish robust AML internal control systems; (2) assign the responsibility for AML work to a designated internal department or specialized unit that will lead and oversee AML work; (3) regularly assess money laundering risk levels and develop corresponding risk management systems and procedures, as well as establish relevant information systems as needed; and (4) supervise the effective implementation of internal control systems through internal or external audits. In general, these requirements have been provided in several existing PBOC rules (such as the Measures for the Supervision and Administration of Anti-money Laundering and Counter- terrorism Financing of Financial Institutions (PBOC Order [2021] No. 3) (《金融机构反洗钱和反恐怖融资监督管理办法》(中国人民银行令[2021]第3号))，the Administrative Measures for the Due Diligence of Clients and the Preservation of Clients' Identities and Transaction Records by Financial Institutions (《金融机构客户尽职调查和客户身份资料及交易记录保存管理办法》) and will not introduce new or additional onerous burdens for foreign-funded banks.

Articles 4 and 30 of the Amended AML Law require AML obligors (including foreign-funded banks) to take measures in proportion to the money-laundering risks of their clients, and to safeguard the basic and necessary financial services of clients. 

Article 39 of the Amended AML Law further entitles clients to raise objections on the risk management measures taken by a financial institution to counter money laundering risks by means of (i) making complaints with the relevant financial institution;   (ii) if no response is received from the relevant financial institution within the specified period, or if the client is dissatisfied with the response, making complaints with the PBOC; or (iii) filing a lawsuit against the relevant financial institution. The financial institution receiving the complaint must address the complaint and reply to the client within 15 days, or promptly where the complaint is related to basic and necessary financial services.

Article 32 of the Amended AML Law has not changed the regulatory position as already provided in Article 17 of the Original AML Law, and reiterated that a financial institution shall not be exempted from its own liabilities where it has entrusted a third party to carry out CDD and such third party does not take required due diligence measures under the Amended AML Law. The entrusted third parties are also required to provide necessary due diligence information to the entrusting financial institutions and to cooperate with them for constant CDD.

Notably, to facilitate the CDD by financial institutions, PBOC will coordinate with relevant governmental departments (including public security, administration of market regulation, civil administration, tax, immigration administration and telecommunication administration authorities) to provide necessary support for financial institutions to verify clients’ identity.

Article 34 of the Amended AML Law has significantly extended the minimum retention period for client identification data and transaction information from five (5) years to ten (10) years.

Article 40 of the Amended AML Law has introduced a new regulatory regime of AML special precaution measures, which shall be complied with by any entity and individual against the entities and persons on the specified lists (the “Black Lists”), i.e., any entity and individual must immediately stop the provision of financial and other services or funds and assets to the entities and persons on the Black Lists and their agents, entities and individuals under their instructions, and entities directly or indirectly controlled by them, and must immediately restrict the transfer of relevant funds and assets. The Black Lists include (i) the list of terrorist entities and individuals identified by the national anti-terrorism leading body and announced by its office; (ii) the list of entities and individuals involved in targeted financial sanctions in the notice of the implementation of the UN Security Council resolution issued by the Ministry of Foreign Affairs; and (iii) the list of entities and individuals identified by the PBOC or in conjunction with relevant state departments as having major money laundering risks and which may cause serious consequences if no measures are taken.

Notably, offshore financial institutions that have opened correspondent bank accounts in the PRC or have other close financial ties with the PRC, if failed to cooperate with PRC regulators for AML investigation, may be enlisted in the Black Lists. Please refer to paragraph 12 below for more detailed information.

Article 43 of the Amended AML Law has empowered the city-level branch of PBOC to conduct AML investigations and AML obligors must provide requested documents and information within prescribed timeframe, while under the Original AML Law, the investigation power sits with the provincial level of PBOC or above.

Article 12 of the Amended AML Law has introduced a clause for the extra-territorial application of the Amended AML Law, which provides that money laundering and terrorist financing activities outside the territory of the PRC that endanger the sovereignty and security of the PRC, infringe upon the legitimate rights and interests of citizens, legal persons and other organizations of the PRC, or disrupt the financial order within the PRC shall be dealt with in accordance with the Amended AML Law and relevant laws and regulations, and the legal liabilities shall be pursued accordingly.

Article 49 of the Amended AML Law also imposes an obligation on offshore financial institutions that have opened correspondent bank accounts in the PRC or have other close financial ties with the PRC to cooperate with the investigations initiated by PRC regulators on money laundering and terrorist financing activities in accordance with the principle of reciprocity or the consensus agreement with relevant countries. The violation of such obligation will subject the offshore financial institutions to various administrative actions, including, without limitation, monetary fines, prohibition from engaging in certain business, enlisting in the Black Lists, as a result of which, any entity and individual in the PRC must take AML special precaution measures against such offshore financial institution.

• Article 52 of the Amended AML Law broadens the types of violations and significantly raises the penalty limits. For example, AML internal control-related violations have increased from three (3) to nine (9) categories, and depending on the seriousness of the violations, financial institutions in violation will be subject to order to make corrections, a warning, fines of up to RMB 200,000 or even RMB 2 million in more severe cases, along with possible restrictions or prohibitions on engaging in certain business.

• Under Article 56 of the Amended AML Law, supervisors are now included as subjects for penalties, with increased fines for responsible directors, supervisors, senior managers, and other directly responsible personnel, reaching up to RMB 1 million per individual.

• Article 56 of the Amended AML Law has, for the first time, introduced the option of exemption from liabilities for individuals (namely the responsible directors, supervisors, senior managers, and other directly responsible personnel in the AML obligors), whereby the individuals can be exempt from administrative liabilities under the Amended AML Law if they can prove that they have diligently implemented AML measures.

The Amended AML Law marks an important step in the development of AML work in China and introduces several innovative regimes which can help foreign-funded banks to better comply with AML related obligations and counter against money laundering risks. However, some issues under the Amended AML Law still remain to be clarified, such as the interactions with offshore regulators and how the Amended AML Law would apply to offshore financial institutions in practice, etc. We will continue to monitor any further updates in these regards and share our insights as appropriate.